CVE-2019-0280

2019-05-1420:20:04

sap

www.cve.org

AI Score

9.1

Confidence

High

EPSS

0.001

Percentile

42.8%

JSON

SAP Treasury and Risk Management (EA-FINSERV 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18 and 8.0; S4CORE 1.01, 1.02 and 1.03), does not perform necessary authorization checks for authorization objects T_DEAL_DP and T_DEAL_PD , resulting in escalation of privileges.

CNA Affected

[
  {
    "product": "SAP Treasury and Risk Management(EA-FINSERV)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 6.0"
      },
      {
        "status": "affected",
        "version": "< 6.03"
      },
      {
        "status": "affected",
        "version": "< 6.04"
      },
      {
        "status": "affected",
        "version": "< 6.05"
      },
      {
        "status": "affected",
        "version": "< 6.06"
      },
      {
        "status": "affected",
        "version": "< 6.16"
      },
      {
        "status": "affected",
        "version": "< 6.17"
      },
      {
        "status": "affected",
        "version": "< 6.18"
      },
      {
        "status": "affected",
        "version": "< 8.0"
      }
    ]
  },
  {
    "product": "SAP Enterprise Financial Services (S4CORE)",
    "vendor": "SAP SE",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.01"
      },
      {
        "status": "affected",
        "version": "< 1.02"
      },
      {
        "status": "affected",
        "version": "< 1.03"
      }
    ]
  }
]